Malta's biggest bank failed for years to detect or address risks involving thousands of payments, the European Central Bank said today in a new report.

The confidential report detailed "severe shortcomings" that could have allowed money laundering or other criminal activities. 

The report, seen by Reuters, said Bank of Valletta had not dealt with a litany of risk management failings despite repeated warnings from the Frankfurt-based regulator stretching back to 2015.

The report calls for remedial measures, including assessing if BoV's top managers are fit for their jobs and reducing exposure to risks posed by foreign clients by the end of this year.

Bank of Valletta said it was strengthening its risk controls, governance structure and anti-financial crime defences and said customers who operated in the gaming industry, a key business in Malta, were most at risk of being hit by remedial measures.

"The bank is today engaged in a priority process - agreed with, and monitored by, its regulators - to deal with the legacy issues highlighted by the report," BoV said. 

Bank of Valletta is the main financial pillar of the Maltese economy, whose growth has been fuelled by attracting offshore gambling, financial and ship registration industries under the centre-left government of Prime Minister Joseph Muscat.

The Mediterranean island, the euro zone's smallest state, already faces questions over its ability to combat crime two years after journalist Daphne Caruana Galizia, who had reported on government corruption, died in a car bombing.

The 47-page ECB report highlights the vulnerability to suspicious transactions of the euro zone's financial system, which has already been rocked by widely-reported money laundering scandals at some of its top banks. 

The ECB lacks power over anti-money laundering lapses, apart from the extreme measure of revoking a bank's licence. 

Malta's police, whose chief is appointed by the government, declined to say whether they were investigating BoV, while a spokesman for Muscat said the prime minister trusted the bank. 

A senior ECB official said BoV had shown "a change of attitude" with its new "de-risking" plan launched in May, but warned that Frankfurt would consider restricting BoV's services to foreign clients and gaming companies if it again failed to shape up. 

It could deploy such measures as part of its remit to protect financial stability.

Italy's UniCredit, which owns 10% of BoV, declined to comment, adding that its stake was "non-strategic".

Although BoV is financially solid as most of its revenues come from local mortgages and deposits, it was exposed to disproportionate risks from its foreign clients, the ECB official said.

With a population of only 420,000, Malta has sought to attract foreign capital with schemes such as a cash for passport programme, although the EU has repeatedly warned of the risks of this attracting the proceeds of criminal activities. 

Despite these warnings, the ECB report said that when foreign nationals seeking to buy passports under the scheme opened an account at BoV, the bank registered them as Maltese citizens, which reduced their risk profile. 

The report said BoV's earlier de-risking strategy in 2018 had focused mainly on maintaining accounts and more than 13,000 suspicious payments, some dating back to February 2014, were still waiting to be assessed.

Meanwhile the number of high-risk foreign customers had actually risen and in many cases BoV had no information about the origins of their wealth.  

The ECB said Bank of Valletta had no unit to identify bribery and corruption among international clients and did not keep a record of those who had payments blocked due to money laundering risks.

BoV declined to comment on specifics of its risk management systems or any customers named in the ECB report saying its dealings with regulators and clients were confidential. 

ECB investigators identified a lack of checks over accounts held by Malta's Pilatus Bank, which was shut last year after its Iranian owner Ali Sadr Hashemi Nejad was arrested in the US on money-laundering and sanctions violation charges.

Despite warnings, BoV kept scant details about the source of wealth of Pilatus' directors and no documentation was provided when Ali Sadr opened an account in 2014, the report said. 

In another case, BoV allowed CenturionBet, a gambling company which the ECB said had its licence withdrawn in Britain in 2009, to continue transferring money even though its licence had also been revoked by Maltese authorities in 2017.